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"ABSTRACT 


2 


The present invention relates to a method and device for model 


3 resolution and its use for detecting attacks against computer systems. The 

4 device comprises adapter software for translating the information from the log 

5 file, formulated in the specific language of the machine, into a language 

6 understandable by the interpreter, an interpreter receiving the information 

7 from the adapter and receiving the formulation of the specification in the 

8 temporal logic in a specification formula in order to expand this formula and fill 

9 in the table and the stack of worked subformulas described above resulting 


10 from the scanning of the machine's log file, and a clause processing algorithm 


1 1 for resolving the Horn clauses using the information from the table and the 


12 stack of worked subformulas, this clause processing algorithm generating an 
r 13 output file or generating an action. -- 
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